Overview

overview

10

Static

static

6

e4cfd6fc03...8e.apk

android-9-x86

10

e4cfd6fc03...8e.apk

android-10-x64

10

e4cfd6fc03...8e.apk

android-11-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4cfd6fc03feee2e8b6e687068cc8430f2c2d3f055f4e69a91c6f83605da128e.bin

  • Size

    2.2MB

  • Sample

    250131-1ww92szqam

  • MD5

    dcbb515f5cb46f88305c943bed265fba

  • SHA1

    b65450ef390d23ca3796962da1e2f6c8441395d3

  • SHA256

    e4cfd6fc03feee2e8b6e687068cc8430f2c2d3f055f4e69a91c6f83605da128e

  • SHA512

    57560f2b96e706efc46ffbec4deb552cc8b5df6755de91d2d465196e18e16f6058603efaa8c563f7b64338b703ad1c272e5da73fcfc87afbaf47aac1d497e8d9

  • SSDEEP

    49152:88SFlgBMebdvOy+CSlNaFloWNmY3NNKvGvb8A5R9:88SMBMI2yRSlIFloWN93fz8AF

Score
10/10
teabotandroidbankercollectioncredential_accessdefense_evasiondiscoveryevasionimpactinfostealerpersistencestealthtrojan

Malware Config

Targets

    • Target

      e4cfd6fc03feee2e8b6e687068cc8430f2c2d3f055f4e69a91c6f83605da128e.bin

    • Size

      2.2MB

    • MD5

      dcbb515f5cb46f88305c943bed265fba

    • SHA1

      b65450ef390d23ca3796962da1e2f6c8441395d3

    • SHA256

      e4cfd6fc03feee2e8b6e687068cc8430f2c2d3f055f4e69a91c6f83605da128e

    • SHA512

      57560f2b96e706efc46ffbec4deb552cc8b5df6755de91d2d465196e18e16f6058603efaa8c563f7b64338b703ad1c272e5da73fcfc87afbaf47aac1d497e8d9

    • SSDEEP

      49152:88SFlgBMebdvOy+CSlNaFloWNmY3NNKvGvb8A5R9:88SMBMI2yRSlIFloWN93fz8AF

    Score
    10/10
    teabotbankercollectioncredential_accessdefense_evasiondiscoveryevasioninfostealerpersistencestealthtrojanimpact

    • TeaBot

      TeaBot is an android banker first seen in January 2021.

      bankertrojaninfostealerteabot

    • TeaBot payload

    • Teabot family

      teabot

    • Removes its main activity from the application launcher

      stealthtrojanevasion

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

      evasion

    • Makes use of the framework's Accessibility service

      Retrieves information displayed on the phone screen using AccessibilityService.

      collectiondefense_evasioncredential_access

    • Obtains sensitive information copied to the device clipboard

      Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

      collectioncredential_accessimpact

    • Acquires the wake lock

    • Performs UI accessibility actions on behalf of the user

      Application may abuse the accessibility service to prevent their removal.

      evasion

    • Queries the mobile country code (MCC)

      discovery

    • Requests disabling of battery optimizations (often used to enable hiding in the background).

      defense_evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1624

Broadcast Receivers

1
T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

1
T1407

Hide Artifacts

2
T1628

Suppress Application Icon

1
T1628.001

User Evasion

1
T1628.002

Impair Defenses

1
T1629

Prevent Application Removal

1
T1629.001

Input Injection

1
T1516

Virtualization/Sandbox Evasion

2
T1633

System Checks

2
T1633.001

Credential Access

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Discovery

System Information Discovery

2
T1426

System Network Configuration Discovery

1
T1422

Lateral Movement

Collection

Clipboard Data

1
T1414

Input Capture

2
T1417

GUI Input Capture

1
T1417.002

Keylogging

1
T1417.001

Screen Capture

1
T1513

Command and Control

Exfiltration

Impact

Data Manipulation

1
T1641

Transmitted Data Manipulation

1
T1641.001

Input Injection

1
T1516

Tasks